Our organization manages roughly 35 certificates across various servers and services. With public certificate lifetimes potentially reaching 47 days by 2029, manually renewing them the way we do today could become a major ongoing workload. I currently renew many certificates 10–20 days early for convenience, but that approach will not make sense when the total lifetime is only 47 days. We also expect additional complications from the transition to R1 certificates. What are other organizations doing to prepare? Are ACME and similar tools mature and flexible enough to handle certificates across different vendors, servers, firewalls, and appliances, or are some systems still likely to require manual work?
5 Answers
For public services, ACME is generally the answer. Tools such as Certbot, Win-ACME, and other ACME clients can work with multiple certificate authorities, not just one provider. DNS-based validation is especially useful when a service is behind a proxy, firewall, or tunnel. The client can retrieve the certificate and run deployment scripts to install it on web servers, firewalls, or other systems.
Make certificate automation a requirement when selecting vendors and products. For systems that cannot obtain or install certificates automatically, investigate putting them behind a reverse proxy that can handle ACME. If that is not possible, estimate the operational cost and start replacing obsolete appliances before short lifetimes turn every renewal into a manual emergency.
Separate internal and external use cases. Internal-only services can usually use an internal CA, such as AD CS, step-ca, Vault, or another managed PKI, with certificate lifetimes appropriate to the organization's security policy. Publicly trusted certificates are still needed for unmanaged clients and certain customer-facing services, so those should be automated with ACME wherever possible.
Some devices, guest networks, and customer-facing portals cannot assume that every client trusts your internal CA. Those exceptions need to be identified rather than handled with a blanket internal-certificate policy.
Treat this as an automation project now rather than waiting for shorter lifetimes to become a crisis. Build a complete certificate inventory, monitor expiration dates, and migrate every compatible public-facing certificate to ACME-based renewal. Renewal should happen roughly monthly, leaving extra time to detect and fix failures before the certificate expires.
The inventory and monitoring are just as important as the renewal tool. A certificate that renews successfully but never gets installed on the actual service can still cause an outage.
Start by identifying the certificates that cannot be automated and classify why: unsupported validation, no installation API, legacy software, or a requirement for public trust. Keep those on an exception list with expiration monitoring and replacement plans. Automation will cover most systems, but a small number of legacy devices may still need scheduled manual renewal.
The hard part is usually deployment, not issuance. Standard web servers are easy, while unusual appliances often need a vendor plugin, API integration, or a custom script.